Handle invalid source control URLs in registry identity lookup

[pepicrft]

Summary

Add validation for source control URLs at multiple levels to handle malformed URLs gracefully.

Problem

When macOS git-credential-osxkeychain fails to find credentials, it outputs error messages that can get concatenated with the original URL:

https://github.com/owner/repo.git': failed looking up identity for https://github.com/owner/repo.git

These malformed URLs were being sent to the registry server, causing errors. This was observed in the Tuist registry where we added server-side validation to return HTTP 400 for invalid URLs (see tuist/tuist#8829).

Solution

1. Add isValid property to SourceControlURL

public var isValid: Bool {
    // URLs with whitespace are invalid
    guard !self.urlString.contains(where: \.isWhitespace) else {
        return false
    }
    // Check for standard URL format or SSH-style git URLs
    ...
}

Valid source control URLs:

• Don't contain whitespace (error messages contain spaces)
• Are parseable as standard URLs with a host, OR
• Match SSH-style git format (user@host:path)

2. Early validation in mapRegistryIdentity

guard url.isValid else {
    throw RegistryError.invalidSourceControlURL(url)
}

This validates URLs before making any HTTP requests to the registry.

3. Handle HTTP 400 from registry servers

case 400:
    throw RegistryError.invalidSourceControlURL(scmURL)

If a URL passes client validation but the server still rejects it with 400 Bad Request, we throw the same specific error.

Changes

• Sources/Basics/SourceControlURL.swift: Added isValid computed property
• Sources/Workspace/Workspace+Registry.swift: Added early URL validation
• Sources/PackageRegistry/RegistryClient.swift:
  • Added invalidSourceControlURL error case
  • Handle 400 response in lookupIdentities
• Tests/BasicsTests/SourceControlURLTests.swift: Added tests for URL validation
• Tests/PackageRegistryTests/RegistryClientTests.swift: Added test for 400 handling

Test Plan

• SourceControlURLTests - Tests for isValid property (4 tests)
• LookupIdentities - Tests for registry client including 400 handling (6 tests)
• All tests pass (10 tests total)
• Build succeeds

Related

• Server-side fix in Tuist registry: tuist/tuist#8829

🤖 Generated with Claude Code

[fortmarek]

wouldn't a better fix be to catch the errors when forming the scmURL over handling it here?

[pepicrft]

Yeah, I'm adjusting that. I also added some code to handle 400 coming from the server.